Vulnerability · NVD

CVE-2024-38476

CRITICAL 9.8 Published on 2024-07-01

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Users are recommended to upgrade to version 2.4.60, which fixes this issue.

Attack vector : Network No privileges required No user interaction

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS 41.61% moderate exploit risk percentile 98.6%

OS versions that fix this CVE

This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.

macOS Fixed in 15.1

View on NVD ↗ Advisory · httpd.apache.org